MAL-2026-19189: Malicious code in spectrova (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (e8a78fd42fc449cadaae37c314b15fc82adf945a869f636718488b7e61baf7a9) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voice-synthesis-profiles
Reasons (based on the campaign):
- other
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
What does exploitation require?
The package acts as a loader that executes code from a supplied URL. Exploitation therefore depends on the loader being run with a URL that serves a remote script.
Does the package need to contain the final payload to be dangerous?
No. The campaign description states that these loader packages may not contain the malicious payload themselves, but they download and execute a remote malicious script.
What should teams do if they cannot immediately determine whether it was used?
Review dependency manifests, lockfiles, package-install records, and build logs for spectrova. If it was installed or executed, investigate the URLs supplied to it and any scripts retrieved from those URLs.